grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation

A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This vulnerability affects all servers created using @grpc/grpc-js, and no workaround is available. An unauthenticated remote...

CVE-2026-48069

@grpc/grpc-js (pure JavaScript implementation) is affected by a crash when processing an invalid incoming compressed message. Affected versions: prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4. Fixed in 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4. Remediation: upgrade to the ...

CVE-2026-48068 @grpc/grps-js: A malformed request can cause a server crash

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in...

CVE-2026-48069

A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming compressed message can cause a client or server process to crash. This vulnerability affects all clients and servers that use @grpc/grpc-js, and no workaround is available. An unauthenticated...

ROOT-APP-NPM-CVE-2026-48068 CVE-2026-48068 in @rootio/grpc__grpc-js - Patched by Root

Root has patched CVE-2026-48068 in the @rootio/grpcgrpc-js package for Root:npm. Multiple fixed versions available...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +133 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.14.0, <=1.14.3)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.2.2, =0.10.0, =0.25.0 - @bnonni/terminal 0.1.0 and more Source cves: CVE-2026-48068 Source advisory: OSV:GHSA-5375-PQ7M-F5R2...

@1xtr/yc-log-client (>=1.0.6, <=1.1.1), @a11ywatch/a11ywatch (>=0.2.126, <=0.3.82) +126 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.10.0, <=1.10.11)

@grpc/grpc-js NPM version =1.10.0, =1.0.6, =0.2.126, =0.8.16, =0.9.58, =4.4.29, =3.1.9, =0.78.0, =1.68.0, =5.7.3, =1.26.5, =8.5.1-alpha.4, =0.1.22, =3.5.2, =3.5.5 and more Source cves: CVE-2026-48068 Source advisory: SNYK:JS-GRPCGRPCJS-17315646...

@alenon/grpc-mock-server (>=3.1.21, <=3.2.3), @aliceo2/bookkeeping (>=1.8.0, <=1.12.0) +153 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.13.0, <=1.13.4)

@grpc/grpc-js NPM version =1.13.0, =3.1.21, =1.8.0, =1.76.0, =1.0.0, =2.0.1, =1.0.7, =2.0.0, =1.1.37, =12.3.0, =0.3.1, =0.3.1, =0.3.8 and more Source cves: CVE-2026-48068 Source advisory: OSV:GHSA-5375-PQ7M-F5R2...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +133 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.14.0, <=1.14.3)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.2.2, =0.10.0, =0.25.0 - @bnonni/terminal 0.1.0 and more Source cves: CVE-2026-48068 Source advisory: SNYK:JS-GRPCGRPCJS-17315646...

@1xtr/yc-log-client (>=1.0.6, <=1.1.1), @a11ywatch/a11ywatch (>=0.2.126, <=0.3.82) +126 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.10.0, <=1.10.11)

@grpc/grpc-js NPM version =1.10.0, =1.0.6, =0.2.126, =0.8.16, =0.9.58, =4.4.29, =3.1.9, =0.78.0, =1.68.0, =5.7.3, =1.26.5, =8.5.1-alpha.4, =0.1.22, =3.5.2, =3.5.5 and more Source cves: CVE-2026-48068 Source advisory: OSV:GHSA-5375-PQ7M-F5R2...

@42zeroo/tescik (>=1.0.0, <=1.1.1963), @agentgate-hedera/hedera-core (>=0.1.1, <=0.1.9) +346 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.12.0, <=1.12.6)

@grpc/grpc-js NPM version =1.12.0, =1.0.0, =0.1.1, =0.1.1, =1.0.44, =3.1.16, =1.1.0, =1.73.0, =0.5.14-alpha-20251013132822, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.19 and more Source cves: CVE-2026-48068 Source advisory: SNYK:JS-GRPCGRPCJS-17315646...

@alenon/grpc-mock-server (>=3.1.21, <=3.2.3), @aliceo2/bookkeeping (>=1.8.0, <=1.12.0) +153 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.13.0, <=1.13.4)

@grpc/grpc-js NPM version =1.13.0, =3.1.21, =1.8.0, =1.76.0, =1.0.0, =2.0.1, =1.0.7, =2.0.0, =1.1.37, =12.3.0, =0.3.1, =0.3.1, =0.3.8 and more Source cves: CVE-2026-48068 Source advisory: SNYK:JS-GRPCGRPCJS-17315646...

@42zeroo/tescik (>=1.0.0, <=1.1.1963), @agentgate-hedera/hedera-core (>=0.1.1, <=0.1.9) +346 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.12.0, <=1.12.6)

@grpc/grpc-js NPM version =1.12.0, =1.0.0, =0.1.1, =0.1.1, =1.0.44, =3.1.16, =1.1.0, =1.73.0, =0.5.14-alpha-20251013132822, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.19 and more Source cves: CVE-2026-48068 Source advisory: OSV:GHSA-5375-PQ7M-F5R2...

-temp-electron-manager-somiibo (0.0.200), 0xpass (>=0.0.2, <=0.0.8) +5340 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.0.0, <=1.9.14)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =2.0.0, =0.3.30, =0.3.30, =0.4.16 and more Source cves: CVE-2026-48068 Source advisory: OSV:GHSA-5375-PQ7M-F5R2...

@alenon/grpc-mock-server (>=3.1.14, <=3.1.15), @aliceo2/bookkeeping (>=0.96.0, <=1.0.1) +84 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.11.0, <=1.11.3)

@grpc/grpc-js NPM version =1.11.0, =3.1.14, =0.96.0, =1.71.0, =0.0.10, =0.0.13, =0.0.10, =0.0.19, =0.0.10, =1.29.0, =0.1.0, =0.1.0, =0.2.5 and more Source cves: CVE-2026-48068 Source advisory: OSV:GHSA-5375-PQ7M-F5R2...

@alenon/grpc-mock-server (>=3.1.14, <=3.1.15), @aliceo2/bookkeeping (>=0.96.0, <=1.0.1) +84 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.11.0, <=1.11.3)

@grpc/grpc-js NPM version =1.11.0, =3.1.14, =0.96.0, =1.71.0, =0.0.10, =0.0.13, =0.0.10, =0.0.19, =0.0.10, =1.29.0, =0.1.0, =0.1.0, =0.2.5 and more Source cves: CVE-2026-48068 Source advisory: SNYK:JS-GRPCGRPCJS-17315646...

-temp-electron-manager-somiibo (0.0.200), 0xpass (>=0.0.2, <=0.0.8) +5340 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.0.0, <=1.9.14)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =2.0.0, =0.3.30, =0.3.30, =0.4.16 and more Source cves: CVE-2026-48068 Source advisory: SNYK:JS-GRPCGRPCJS-17315646...

-temp-electron-manager-somiibo (0.0.200), 0xpass (>=0.0.2, <=0.0.8) +5340 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.0.0, <=1.9.14)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =2.0.0, =0.3.30, =0.3.30, =0.4.16 and more Source cves: CVE-2026-48069 Source advisory: OSV:GHSA-99F4-GRH7-6PCQ...

@42zeroo/tescik (>=1.0.0, <=1.1.1963), @agentgate-hedera/hedera-core (>=0.1.1, <=0.1.9) +346 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.12.0, <=1.12.6)

@grpc/grpc-js NPM version =1.12.0, =1.0.0, =0.1.1, =0.1.1, =1.0.44, =3.1.16, =1.1.0, =1.73.0, =0.5.14-alpha-20251013132822, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.19 and more Source cves: CVE-2026-48069 Source advisory: OSV:GHSA-99F4-GRH7-6PCQ...

@1xtr/yc-log-client (>=1.0.6, <=1.1.1), @a11ywatch/a11ywatch (>=0.2.126, <=0.3.82) +126 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.10.0, <=1.10.11)

@grpc/grpc-js NPM version =1.10.0, =1.0.6, =0.2.126, =0.8.16, =0.9.58, =4.4.29, =3.1.9, =0.78.0, =1.68.0, =5.7.3, =1.26.5, =8.5.1-alpha.4, =0.1.22, =3.5.2, =3.5.5 and more Source cves: CVE-2026-48069 Source advisory: SNYK:JS-GRPCGRPCJS-17315972...